Process and circuitry for monitoring a data processing circuit

ABSTRACT

To monitor a data processing circuit which includes two (or a plurality of) microprocessors or other data processing systems which are mounted on a joint chip and connected by data lines, the microprocessors jointly produce data words which form a data word sequence and are transmitted to a monitoring circuit at predetermined times. The monitoring circuit is arranged on a separate chip. The data words of the data word sequence are checked by the monitoring circuit with respect to the contents and time of appearance of the individual data words. It is favorable to make up the individual data words of partwords which are produced according to different algorithms.

BACKGROUND OF THE INVENTION

The present invention relates to a method of monitoring a dataprocessing circuit which includes two or a plurality of data processingsystems such as microprocessors, microcomputers, or the like, which aremounted on a joint chip and connected by data lines. Circuitries forimplementing the method are also comprised by the present invention.

The proper, fail-free operation of data processing circuits, comprisingmicroprocessors, microcomputers and other programmed circuit systems,must be monitored, as is known in the art. This applies especially whenthe circuits form part of safety-critical control systems. One exampleof a safety-critical application is the controlling intervention in thebrake system of an automotive vehicle, for example, for anti-lockcontrol purposes, for traction slip control or driving stabilitycontrol. When a malfunction of the data processing circuit is detected,the control is deactivated or changed over to a mode of operation whichis still possible despite the error occurred, and is less critical insafety respects.

It is important for such monitoring actions that the malfunction isdetected quickly and with a high degree of reliability. To achieve thisobject, in a control circuit disclosed in German patent No. 32 34 637 (P5248), the input data produced in wheel sensors are processed in twoparallel, identically designed and identically programmedmicrocontrollers which are independent of each other. The output signalsof the two microcontrollers are then checked for correlation. Whendifferences indicative of a malfunction arise, the electronic control isdisabled, and brake functioning is thereby maintained. Thus, the priorart control circuit is based on redundant data processing in twocomplete systems, and the sole purpose of the redundance is to identifyoccurring errors with a high degree of reliability so that the controlsystem can be disabled in this case. The monitoring circuit foridentifying and evaluating arising differences and the deactivationelectronics also have a virtually redundant design. Thus, greatercomplexity must be tolerated for saftey reasons.

Further, German patent application No. 41 37 124 discloses a circuitrywherein the input signals are processed in two parallel microcontrollerswhich have a different design and program, however. Only one of the twomicrocontrollers performs the complete, complicated signal processingoperation. The second microcontroller is mainly used for monitoring, forwhat purpose the input signals, after being conditioned and after timederivatives are produced, are further processed on the basis ofsimplified control algorithms and a simplified control philosophy. Incomparison to the above mentioned prior art circuit, the complexity isreduced by the simplified data processing operation in the monitoringmicrocontroller.

Nowadays, it is in principle also possible to accommodate a plurality ofcomplete data processing systems, for example, two microcomputers, onone single chip, to furnish both microcomputers with the same input dataand to compare the data processing results of both systems for checkingthe proper operation of the systems. However, when the electronicsystems are constructively linked in this fashion, it cannot be ruledout with a sufficiently high degree of reliability that, with definedcircuit defects or a malfunction having equal effect on both systems, acorrect monitoring signal will be produced even if an error exists.

A sufficiently reliable detection of malfunctions cannot be expected atall in a circuit based on one single data processing system inconnection with a monitoring operation of the conventional type.

Finally, German patent application No. 40 04 782 discloses an anti-locksystem having two microcontrollers which both generate a monitoringsignal that represents an alternating signal with a predeterminedfrequency and a predetermined variation. A safety circuit compares thealternating signals with a time standard derived from a clock generatorwhich is independent of the working clock of the microcontroller. Avariation of the alternating signal as well as failure of the timestandard leads to a deactivation of the anti-lock control. The controlis disabled when the pulses drop from the predetermined time window.This circuit is also based on using two microcontrollers of redundantoperation.

An object of the present invention is to monitor a data processingcircuit comprising two or a plurality of processors mounted on onesingle chip, or other data processing systems and to achieve thatmalfunctions are detected and signalled with a high degree of safety andreliability. Further, the expenditure required to achieve the presentmethod and the corresponding circuit should be minimized.

SUMMARY OF THE INVENTION

It has been found that this object can be achieved by a method includingthat the data processing systems jointly produce data words and a dataword sequence which are transmitted at predetermined times to amonitoring circuit that is mounted on a separate chip, and are checkedby the monitoring circuit with respect to the contents and the time ofoccurrence of the individual data words.

In a preferred aspect of the present invention, parts of the individualdata words which produce the data word sequence are generated in thedata processing systems, and the partwords are put together in one ofthe data processing systems to the complete word which, as a whole, isthen transmitted to the monitoring circuit.

Safety is considerably enhanced because the partwords are producedaccording to different algorithms in the individual data processingsystems. In a malfunction having effect on all data processing systems,it cannot be expected that correct partwords are produced which, afterbeing put together, would provide the correct data word.

It has been found to be particularly appropriate that the individualwords of the data word sequence are checked for correlation with respectto contents and time with words generated in the monitoring circuit, andthat an error detection signal and/or deactivation signal is triggeredwhen differences arise, or when the differences exceed predeterminedlimit values. Small timing differences are tolerable, for example.

Appropriately, partwords are also produced in the monitoring circuit andput together to complete words, and the partwords in turn can begenerated according to different algorithms.

According to another aspect of the present invention, the individualdata words have a length of 8 bit and are composed of two partwords ofequal length each. According to still another aspect of the presentinvention, the partwords are produced in the monitoring circuit byhardware, i.e. by mask-programmed circuit technology, and in the dataprocessing systems by software, i.e. by a corresponding programming. Oneof the partwords is produced according to the relation (Gl.1)

WD_(n+1) (3) from WD_(n) (2)

WD_(n+1) (2) from WD_(n) (1)

WD_(n+1) (1) from WD_(n) (0)

WD_(n+1) (0) from [WD_(n-1) (3) XOR WD_(n) (1)] XOR WD_(n) (0)

and the other partword is produced according to the relation (Gl.2)

WD_(n+1) (3) from WD_(n) (2)

WD_(n+1) (2) from WD_(n) (1)

WD_(n+1) (1) from WD_(n) (0)

WD_(n+1) (0) from WD_(n) (3) XOR WD_(n) (2)

wherein

(0 . . . 3) . . . is the respective place of the 4-bit partword,

n . . . is the point of time in the working clock,

XOR . . . is the logic linking "exclusive OR", and

from . . . implies "results from".

According to one prferred embodiment of a circuitry, two integratedcircuits, each representing a complete data processing system and beinginterconnected by data lines, are mounted on one joint chip, and onepartword is produced in each of the two data processing systems. Onesystem will then take care of joining the partwords to a complete dataword, and of transmitting it to the monitoring circuit. The other dataprocessing system performs the control of the word transmission to themonitoring circuit. This "task sharing" further increases the circuitsafety on the basis of the monitoring concept according to the presentinvention.

Further features, advantages and possible applications of the presentinvention can be seen in the following description of details by way ofembodiments of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS

In the drawings,

FIG. 1 is a schematic view of t he basic design of a circuitry of thepresent invention.

FIG. 2 is a schematic view of the circuitry of FIG. 1 including furtherdetails of the monitoring circuit.

FIG. 2A is the variation of a signal at the input of the monitoringcircuit.

FIG. 3 is an embodiment of the monitoring circuit of FIG. 2.

DETAILED DESCRIPTION OF THE DRAWINGS

FIG. 1 is used to explain the monitoring concept on which the presentinvention is based. In this embodiment, two complete microprocessorsMP1, MP2, microcomputers or other data processing systems are mounted ona silicon chip IC1. The microprocessors can be the two microprocessorsin the electronic part of an automotive vehicle control system, such asan anti-lock control system (ABS), traction slip control system (TCS) ora driving stability control system (DSC). The two processors or dataprocessing systems MP1, MP2 are interconnected by data lines 1. Amonitoring circuit 4, referred to as "watchdog" (WD) is connected to oneof the two processors (in this case to processor MP2) by a serialinterface SSIO. An output "OUT" leads to a safety switch whichdeactivates the control, changes it over, and/or issues an errordetection signal when the monitoring circuit identifies an error.

Finally, FIG. 1 shows a signal line CSN which extends from the dataprocessing system MP1 to the monitoring circuit 4. Signal line CSN isused to control the transmission of the data from the processor MP2 tothe monitoring circuit 4 which will be explained in detail in thefollowing.

Illustrated and described are only those measures and circuit partsprovided to monitor the proper operation of the two processors MP1, MP2.The steps required for the actual data processing operation are notshown.

According to the present invention, the two microprocessors MP1, MP2produce data words and a data word sequence for monitoring purposeswhich are transmitted to the monitoring circuit 4 and are checked forcorrelation with a predetermined data word sequence or with theindividual data words. Both the correlation of the individual data wordswith respect to the contents and timing of the individual data words ismonitored. When differences occur, or when the differences exceedpredetermined limit values, this is assessed as an error and signalledby way of output OUT.

According to the present invention, the individual words of the dataword sequence are generated by producing partwords which are then joinedto complete words. This joining action is effected in themicroprocessors MP1, MP2 by software or corresponding programming of themicroprocessors. The corresponding data word is produced in themonitoring circuit 4 by hard-wired circuit electronics, as will bedescribed hereinbelow by way of FIG. 3.

The individual data words have a length of 8 bit in the presentembodiment. The data words are composed of two partwords of 4 bit each.The partwords are produced in the microprocessors MP1, MP2. According toFIG. 1, a microprocessor, i.e. microprocessor MP2, takes care of joiningthe two partwords and transmitting the complete word to the monitoringcircuit 4 by way of the serial interface SSIO. The other microprocessor,i.e. MP1, which does not participate in joining the partwords, governsthe transmission of the complete words from the microprocessor MP2 tothe monitoring circuit 4 by way of signal line 2 CSN (chip-select,N=low-active). A complete data word is produced and transmitted in eachworking clock which may be in the order of 7 msec. Another data wordfollows in the next clock. In the present case, which will still beexplained, the word sequence includes 210 different words in an endlesssequence.

The two partwords produced in the processors MP1, MP2 are generated onthe basis of different algorithms according to the present invention.This is very important for the safety or error detectability whenapplying the method of the present invention.

Data words are produced as follows:

In the embodiment of FIG. 1, initially, a data word half is produced ineach processor MP1, MP2 by read access to its program memory. The wordhalf produced in the microprocessor MP1 is now transmitted by theparallel data connection 1 to the microprocessor MP2 and joined thereinto a complete data word. When the microprocessor MP2 makes a mistake injoining the word halves, the complete data word would be wrong. Theproduction of the data word is completed. The word is now transmitted tothe monitoring circuit 4, mounted on a separate chip (IC2), at the exactpoint of time, for example upon expiry of a working clock, by way of theserial interface SSIO. The data word is delegated to a shift register ofthe monitoring circuit 4. The transmission is effected as soon as signalCSN is applied to line 2. CSN is the signal releasing the shift registerin the monitoring circuit 4.

In the embodiment of FIG. 1, the microprocessor MP2 determines thetransmission of a correct word, or its contents, and microprocessor MP1determines the timing, i.e. the transmission at the proper time. Thetransmitted word is compared with the predetermined word for correlationin the monitoring circuit 4. In the presence of proper correlation,change-over to the next word is made in each clock which is thenassessed in a predetermined time window.

It is, of course, also possible that the microprocessor MP2 handles thecomplete transmission, including CSN. However, this would reduce thesafety of error detection.

The assembly groups being part of the monitoring circuit 4 and mountedon the joint chip IC2 are shown in FIG. 2. The data words of the dataword sequence jointly produced in the microprocessors MP1, MP2 aretransmitted by the serial interface to the shift register and theintermediate memory forming part of the SSIO input 5. In a comparator 6,the individual data words WDPROC are compared with the predeterminedwords WDGEN which are produced in the monitoring circuit 4 by thegenerator (GEN) 7. A circuit 8 for producing the RESET signals and anoscillator and divider 9 for producing the working clock WDCLK are alsoshown.

Data words which result in the predetermined data word sequence areproduced in the monitoring circuit 4 (IC2) by way of a hard-wired logiccircuit. The data words are then compared for correlation with datawords and a data word sequence produced by software in themicroprocessors MP1, P2 and transmitted to circuit 4. The comparisonresult (WD) is assessed by an analyzing circuit 11. A circuit 10includes a so-called safety cut-out.

FIG. 3 explains in detail an embodiment of the monitoring circuit 4 ofFIGS. 1 and 2. In detail, the design and operation is as follows:

The data words or watchdog words produced in the processor circuit (IC1)are transmitted to the input 5 of the monitoring circuit 4 in definedintervals, i.e. in the working clock, by way of the serial interfaceSSIO (lines: SIN, SOUT, SCK, CSN). The data prevailing at connection SINare shifted into the input shift register of the input circuit 5 by wayof clock SCLK. With the leading flank of the low-active CSN signal, thedata in the input shift register are written in an intermediate memory,which is also comprised in the input circuit 5, and are then availablefor assessment as 8-bit data word WDRPOC(0:7) on a bus. The signal LDWDprovided by the input circuit 5 results from the signals CSNWD and SCLKin the manner shown in FIG. 2A.

The data word WDPROC(0:7) originating from the microprocessors MP1, MP2is now compared with the data word WDGEN(0:7) generated in themonitoring circuit 4 by way of the comparator 6. The signal WD at theoutput of the comparator 6 is `1` when both data words are equal.

The 8-bit data word as well as the data word produced by processors MP1,MP2 or in the chip IC1 is made up in the monitoring circuit 4 of twopartwords which each have a width of 4 bit. The first of the partwordsWDGEN(0:3) produced in the monitoring circuit 4 is generated by the topfive flipflops and the second partword WDGEN(4:7) is generated by theunderlying four flipflops and the respective exclusive OR feedbacks.This watchdog generator is clocked with a pulse WDP and generates witheach leading clock flank a new data word in dependence on the presentdata word. The type of feedback determines the words of the wordsequence and the length of the word sequence. In the present embodiment,the word sequence of the first partword is made up of 14 different 4-bitwords, and the length of the second partword is made up of 15 different4-bit words. These watchdog generator words WDGEN are produced accordingto the algorithms indicated hereinbelow. For the first partwordWDGEN/0:3), the relation Gl.1 applies:

WD_(n+1) (3) from WD_(n) (2)

WD_(n+1) (2) from WD_(n) (1)

WD_(n+1) (1) from WD_(n) (0)

WD_(n+1) (0) from [WD_(n-1) (3) XOR WD_(n) (1)] XOR WD_(n) (0)

and for the other partword the relation Gl.2 applies:

WD_(n+1) (3) from WD_(n) (2)

WD_(n+1) (2) from WD_(n) (1)

WD_(n+1) (1) from WD_(n) (0)

WD_(n+1) (0) from WD_(n) (3) XOR WD_(n) (2).

The abbreviations have the following meaning:

WD=WDGEN=watchdog data word, generated by the generator GEN,

(0 . . . 3) . . . is the respective place of the 4-bit partword,

n . . . is the point of time in the working clock,

XOR . . . is the logic linking "exclusive OR", and

from . . . implies "results from".

The algorithms (Gl. 1, Gl. 2) for the production of the two partwords,hence, are different from each other. The provision of the complete wordby joining the two partwords, which each produce a word sequence of 14different or 15 different 4-bit words in total, results in an endlesssequence of 210 different 8-bit data words composed of the 4-bitpartwords. This is illustrated in the following table:

Initial word (1): 1 000 0001

                  TABLE                                                           ______________________________________                                        data word                                                                              partword     partword  complete word;                                  No. acc. to G1.1 acc. to G1.2 word sequence                                 ______________________________________                                         (1)      (1) 1000     (1) 0001 10000001                                         (2)  (2) 1100  (2) 1000 11001000                                              (3)  (3) 0110  (3) 0100 01100100                                             . . . .                                                                       . . . .                                                                       . . . .                                                                       (14) (14) 0000 (14) 0111 00000111                                             (15)  (1) 1000 (15) 0011 10000011                                             (16)  (2) 1100  (1) 0001 11000001                                             (17)  (3) 0110  (2) 1000 01101000                                             . . . .                                                                       . . . .                                                                       . . . .                                                                       (28) (14) 0000 (13) 1111 00001111                                             (29)  (1) 1000 (14) 0111 10000111                                             (30)  (2) 1100 (15) 0011 11000011                                             (31)  (3) 0110  (1) 0001 01100001                                             . . . .                                                                       . . . .                                                                       . . . .                                                                       (209)  (13) 0001 (14) 0111 00010111                                           (210)  (14) 0000 (15) 0011 00000011                                           (211)   (1) 1000  (1) 0001 10000001                                           (212)   (2) 1100  (2) 1000 11001000                                           . . . .                                                                       . . . .                                                                       . . . .                                                                     ______________________________________                                    

For this endless sequence of 210 different data words the relation

W_(n) =W.sub.(n+m· 210)

W_(n) =nth word of the 8-bit data word sequence

n,m=natural numbers 1, 2, 3 . . . applies.

The flipflops of the watchdog generator are occupied with the initialword of the word sequence `1000 0001` during the reset operation.

After an interval of 1 to 2 periods of the working clock WDCLK ofmonitoring circuit 4, the signal DOREAD at the input of an AND gate 12becomes `1` after a leading flank of the signal LDWD supplied by theinput circuit 5. The result is that the comparison made in circuit 6 ofthe data word (WDPROC(1:7) supplied by the processors with the data word(WDGEN(1:7) generated in the monitoring circuit or the comparison resultWD is evaluated. WDP will be set accordingly with the next leading flankof the clock WDCLK. WDP becomes `1` in the event of correlation of bothdata words. The watchdog generator switches over to the next watchdogword due to the resulting 0-1 flank of the WDP signal. WDPROC(0:7) isstill on the previous word at this time. Thus, WD becomes `0`. WDPbecomes `0` again with the next leading flank of the clock WDCLK. Thus,WDP is `1` exactly for a period of the clock WDCLK.

A time window for the watchdog pulse WDCLK is defined by signals TB,TA₋₋ N and TE. These three signals are generated by way of a 9-steptimer which is clocked with WDCLK. The signal TIMERRES resets the timer(TB=`1`, TA₋₋ N=`1`, TE=`1`). The start of the time window is reached assoon as TAN becomes `0` for the first time. In consideration of the factthat the signal TIMERRES is released synchronously with the trailingflank of the pulse WDCLK (i.e. becomes `0`), this condition occurs afterexactly 127.5 WDCLK pulses. The end of the time window is reached assoon as TBE becomes `1` for the first time (after 287.5 WDCLK pulses).

After the reset (signal MRESET) of the entire watchdog or monitoringcircuit, the signal QWD is zero at the output of the analyzing circuit11, i.e. QWD=`0`. A safety switch will adopt its position "disabled" or"error detected" by way of output OUT. Only after the second watchdogsignal or the second data word has been transmitted correctly will QWDbe switched to `1` by a `1` at signal FLAGEN.

The signal I2 is `0` after the reset. Thus, the RS flipflop arrangedbetween I2 and I3 is set to `0` on the output side. Detection of apremature watchdog pulse WDP is disabled this way. This means that thefirst watchdog word or data word may be sent immediately after thereset. The start of the time window as well as the end of the timewindow is relevant for all following data words because the RS flipflopwas set to `1` by the preceding watchdog pulse WDP and is reset to `0`only when the time window start is reached. When a watchdog pulse WDPcomes too early, i.e. while I3=`1`, QWD1 becomes `1`, with the resultthat QWD is set to `0` which, in turn, means "safety cut-out" or "errordetection".

When the watchdog words or data words are constantly sent correctlyaccording to the predetermined time window, the signal TBE will neverbecome `1` because the timer is in each case reset again by the watchdogpulse WDP before the time window end is reached. If, however, the end ofthe time window is exceeded, TBE becomes `1` and the subsequent RSflipflop is set thereby. `1` at TBEMON causes resetting of the outputflipflop. Consequently, the output signal QWD becomes `0`, and thesafety cut-out is triggered.

A wrong watchdog word or data word does not cause a watchdog pulse WDP.In this case, error detection and safety cut-out occurs in response tothe time when the wrong data word is sent and depending on whether thewrong data word is still followed by a correct data word within the timewindow. The following examples explain this condition.

EXAMPLE 1

A wrong data word is sent inbetween two correct data words, and thesecond data word is transmitted still before the end of the time window(TBE=`1`). In this case, the signal CLKMON adopts the value `1` with thetrailing flank of the chip-select signal CSNWD pertaining to the seconddata word. The output flipflop is reset thereby.

EXAMPLE 2

No correct data word is sent in this case until the time window end(TBE=`1`) is reached. Because the wrong data word does not produce awatchdog pulse WDP, the output TBEMON adopts the value `1`. Therefore,error detection or safety cut-out occurs due to this timeout.

Thus, according to the present invention, the data words are checked inthe monitoring circuit both with respect to their correct contents andtheir timing.

What is claimed is:
 1. A method of monitoring a data processing circuitwhich includes at least two data processing systems, which are mountedon a joint chip and connected by data lines, wherein the data processingsystems jointly produce data words and a data word sequence which aretransmitted at predetermined times to a monitoring circuit that ismounted on a separate chip, and are checked by the monitoring circuitwith respect to the contents and time of appearance of the individualdata words wherein parts of the individual data words of the data wordsequence are produced in each of the data processing systems, whereinthe partwords are put together in one of the data processing systems toa complete word, as a whole, and the other data processing systemgoverns the transmission of the complete data word, from the processingsystem which joins the words to the monitoring circuit wherein thepartwords are produced according to different algorithms in the dataprocessing systems.
 2. The method as claimed in claim 1, wherein theindividual words of the data word sequence are checked for correlationwith respect to contents and time with words generated in the monitoringcircuit, and wherein an error detection signal and/or deactivationsignal is triggered when differences exceeding a predetermined limitvalue occur.
 3. The method as claimed in claim 1, wherein partwords areproduced in the monitoring circuit and put together to complete words.4. The method as claimed in claim 3, wherein the partwords are generatedin the monitoring circuit irrespective of each other according todifferent algorithms.
 5. The method as claimed in claim 1, wherein thepartwords and data word sequences are produced in the data processingsystems by programming the data processing systems and are produced inthe monitoring circuit by hard-wired electronic circuits.
 6. The methodas claimed in claim 1, wherein the individual data words of the wordsequences have a length of 8 bit and are composed of two partwords ofequal length each.
 7. The mathod as claimed in claim 6, wherein, in themonitoring circuit and by means of the data processing systems, one ofthe partwords is produced according to the relationWD_(n+1) (3) fromWD_(n) (2) WD_(n+1) (2) from WD_(n) (1) WD_(n+1) (1) from WD_(n) (0)WD_(n+1) (0) from [WD_(n-1) (3) XOR WD_(n) (1)] XOR WD_(n) (0)and theother partword is produced according to the relation WD_(n+1) (3) fromWD_(n) (2) WD_(n+1) (2) from WD_(n) (1) WD_(n+1) (1) from WD_(n) (0)WD_(n+1) (0) from WD_(n) (3) XOR WD_(n) (2) wherein(0 . . . 3) . . . isthe respective place of the 4-bit partword, n . . . is the point of timein the working clock, XOR . . . is the logic linking "exclusive OR", andfrom . . . implies "results from".
 8. Circuitry as claimed in claim 1,wherein the monitoring circuit is configured as a hard-wired logiccircuit capable of producing the partwords on the basis of differentalgorithms, of joining the partwords to complete data words andcomparing them with the individual words of the data word sequenceproduced in the data processing systems.
 9. A method of monitoring adata processing circuit which includes at least two data processingsystems, which are mounted on a joint chip and connected by data lines,wherein the data processing systems jointly produces data words and adata word sequence which are transmitted at predetermined times to amonitoring circuit that is mounted on a separate chip, and are checkedby the monitoring circuit with respect to the contents and time ofappearance of the individual data words wherein parts of the individualdata words of the data word sequence are produced in each of the dataprocessing systems, wherein the partwords are put together in one of thedata processing systems to complete a word as a whole, and the otherdata processing system governs the transmission of the complete dataword, from the data processing system which joins the part words to themonitoring circuit, wherein partwords are produced in the monitoringcircuit and put together to complete words.
 10. The method as claimed inclaim 9, wherein the partwords are produced according to differentalgorithms in the data processing systems.
 11. The method as claimed inclaim 9, wherein the individual words of the data word sequence arechecked for correlation with respect to contents and time with wordsgenerated in the monitoring circuit, and wherein an error detectionsignal and/or deactivation signal is triggered when differencesexceeding a predetermined limit value occur.
 12. The method as claimedin claim 9, wherein the partwords are generated in the monitoringcircuit irrespective of each other according to different algorithms.13. The method as claimed in claim 9, wherein the partwords and dataword sequences are produced in the data processing systems byprogramming the data processing systems and are produced in themonitoring circuit by hard-wired electronic circuits.
 14. The method asclaimed in claim 9, wherein the individual data words of the wordsequences have a length of 8 bit and are composed of two partwords ofequal length each.
 15. The method as claimed in claim 14, wherein, inthe monitoring circuit and by means of the data processing systems, oneof the partwords is produced according to the relationWD_(n+1) (3) fromWD_(n) (2) WD_(n+1) (2) from WD_(n) (1) WD_(n+1) (1) from WD_(n) (0)WD_(n+1) (0) from [WD_(n-1) (3) XOR WD_(n) (1)] XOR WD_(n) (0)And theother partword is produced according to the relation WD_(n+1) (3) fromWD_(n) (2) WD_(n+1) (2) from WD_(n) (1) WD_(n+1) (1) from WD_(n) (0)WD_(n+1) (0) from WD_(n) (3) XOR WD_(n) (2) wherein(0 . . . 3) . . . isthe respective place of the 4-bit partword, n . . . is the point of timein the working clock, XOR . . . is the logic linking "exclusive OR", andFrom . . . Implies "results from".
 16. Circuitry as claimed in claim 9,wherein the monitoring circuit is configured as a hard-wired logiccircuit capable of producing the partwords on the basis of differentalgorithms, of joining the partwords to complete data words andcomparing them with the individual words of the data word sequenceproduced in the data processing systems.
 17. A method of monitoring adata processing circuit which includes at least two data processingsystems, which are mounted on a joint chip and connected by data lines,wherein the data processing systems jointly produces data words and adata word sequence which are transmitted at predetermined times to amonitoring circuit that is mounted on a separate chip, and are checkedby the monitoring circuit with respect to the contents and time ofappearance of the individual data words wherein parts of the individualdata words of the data word sequence are produced in each of the dataprocessing systems, wherein the partwords are put together in one of thedata processing systems to complete a word as a whole, and the otherdata processing system governs the transmission of the complete dataword, from the data processing system which joins the part words to themonitoring circuit, wherein the individual data words of the wordsequences have a length of 8 bit and are composed of two partwords ofequal length each wherein, in the monitoring circuit and by means of thedata processing systems, one of the partwords is produced according tothe relationWD_(n+1) (3) from WD_(n) (2) WD_(n+1) (2) from WD_(n) (1)WD_(n+1) (1) from WD_(n) (0) WD_(n+1) (0) from [WD_(n-1) (3) XOR WD_(n)(1)] XOR WD_(n) (0)And the other partword is produced according to therelation WD_(n+1) (3) from WD_(n) (2) WD_(n+1) (2) from WD_(n) (1)WD_(n+1) (1) from WD_(n) (0) WD_(n+1) (0) from WD_(n) (3) XOR WD_(n) (2)wherein(0 . . . 3) . . . is the respective place of the 4-bit partword,n . . . is the point of time in the working clock, XOR . . . is thelogic linking "exclusive OR", and From . . . Implies "results from". 18.The method as claimed in claim 17, wherein the partwords are producedaccording to different algorithms in the data processing systems. 19.The method as claimed in claim 17, wherein the individual words of thedata word sequence are checked for correlation with respect to contentsand time with words generated in the monitoring circuit, and wherein anerror detection signal and/or deactivation signal is triggered whendifferences exceeding a predetermined limit value occur.
 20. The methodas claimed in claim 17, wherein partwords are produced in the monitoringcircuit and put together to complete words.
 21. The method as claimed inclaim 20, wherein the partwords are generated in the monitoring circuitirrespective of each other according to different algorithms.
 22. Themethod as claimed in claim 17, wherein the partwords and data wordsequences are produced in the data processing systems by programming thedata processing systems and are produced in the monitoring circuit byhard-wired electronic circuits.
 23. Circuitry as claimed in claim 17,wherein the monitoring circuit is configured as a hard-wired logiccircuit capable of producing the partwords on the basis of differentalgorithms, of joining the partwords to complete data words andcomparing them with the individual words of the data word sequenceproduced in the data processing systems.
 24. A method of monitoring adata processing circuit which includes at least two data processingsystems, which are mounted on a joint chip and connected by data lines,wherein the data processing systems jointly produces data words and adata word sequence which are transmitted at predetermined times to amonitoring circuit that is mounted on a separate chip, and are checkedby the monitoring circuit with respect to the contents and time ofappearance of the individual data words, wherein the circuitry includestwo integrated circuits, mounted on one joint chip, each circuitrepresenting a complete data processing system and being interconnectedby data lines, the circuitry being capable of producing one partword ineach of the two data processing systems, wherein one of the two dataprocessing systems is capable of joining the partwords and the otherdata processing system govern the transmission of the complete data wordto a monitoring circuit.
 25. The method as claimed in claim 24, whereinthe partwords are produced according to different algorithms in the dataprocessing systems.
 26. The method as claimed in claim 24, wherein theindividual words of the data word sequence are checked for correlationwith respect to contents and time with words generated in the monitoringcircuit, and wherein an error detection signal and/or deactivationsignal is triggered when differences exceeding a predetermined limitvalue occur.
 27. The method as claimed in claim 24, wherein partwordsare produced in the monitoring circuit and put together to completewords.
 28. The method as claimed in claim 27, wherein the partwords aregenerated in the monitoring circuit irrespective of each other accordingto different algorithms.
 29. The method as claimed in claim 24, whereinthe partwords and data word sequences are produced in the dataprocessing systems by programming the data processing systems and areproduced in the monitoring circuit by hard-wired electronic circuits.30. The method as claimed in claim 24, wherein the individual data wordsof the word sequences have a length of 8 bit and are composed of twopartwords of equal length each.
 31. The method as claimed in claim 30,wherein, in the monitoring circuit and by means of the data processingsystems, one of the partwords is produced according to therelationWD_(n+1) (3) from WD_(n) (2) WD_(n+1) (2) from WD_(n) (1)WD_(n+1) (1) from WD_(n) (0) WD_(n+1) (0) from [WD_(n-1) (3) XOR WD_(n)(1)] XOR WD_(n) (0)And the other partword is produced according to therelation WD_(n+1) (3) from WD_(n) (2) WD_(n+1) (2) from WD_(n) (1)WD_(n+1) (1) from WD_(n) (0) WD_(n+1) (0) from WD_(n) (3) XOR WD_(n) (2)wherein(0 . . . 3) . . . is the respective place of the 4-bit partword,n . . . is the point of time in the working clock, XOR . . . is thelogic linking "exclusive OR", and From . . . Implies "results from". 32.Circuitry as claimed in claim 24, wherein the monitoring circuit isconfigured as a hard-wired logic circuit capable of producing thepartwords on the basis of different algorithms, of joining the partwordsto complete data words and comparing them with the individual words ofthe data word sequence produced in the data processing systems.